fix: harden social input normalization

[vaguul]

Summary

• replace regex-based path cleanup with bounded linear parsing
• reject YouTube and Twitch lookalike hostnames and decode HTML entities once
• update development dependencies, resolve the esbuild advisory, pin GitHub Actions, and add Dependabot cooldowns

Validation

• npm run typecheck
• npm test (12 passing)
• npm run build
• npm audit (0 vulnerabilities)
• uvx semgrep scan --config auto --error (0 findings)